Turn access on or off, or change which tools are allowed

PUT

/mcp/access

const url = 'https://api.flotera.com/api/v1/mcp/access';
const options = {
  method: 'PUT',
  headers: {
    cookie: '__Host-erm_session=<__Host-erm_session>',
    'Content-Type': 'application/json'
  },
  body: '{"enabled":true,"reissue":true,"allowed_tools":["example"]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request PUT \
  --url https://api.flotera.com/api/v1/mcp/access \
  --header 'Content-Type: application/json' \
  --cookie __Host-erm_session=<__Host-erm_session> \
  --data '{ "enabled": true, "reissue": true, "allowed_tools": [ "example" ] }'

enabled: false revokes the token. enabled: true issues one if there is none, and otherwise rewrites the scopes of the existing token — the secret survives, so changing permissions never forces the client config to be rewritten.

The plaintext token is returned once, on issue, and never again: the database holds a SHA-256, not the secret.

Omitting allowed_tools on first enable grants read tools only. A default of “everything” would hand the model the ability to change prices before anyone decided it should.

Authorizations

sessionCookie

Request Body^required

application/json

object

enabled

required

boolean

reissue

Issue a new secret for the same token. Permissions and connected OAuth clients are untouched — they hang off the token row, not its secret. Needed because the plaintext is shown exactly once.

boolean

allowed_tools

Tools to allow. Omitted on first enable means read tools only; an empty array means enabled with nothing allowed. These are different intentions and the contract keeps them apart.

Array<string>

Example^generated

{
  "enabled": true,
  "reissue": true,
  "allowed_tools": [
    "example"
  ]
}

Responses

200

Access state; token present only when just issued.

application/json

object

enabled

required

boolean

groups

required

Subject areas in catalog order, with their descriptions. The panel renders one block per area; a list of its own would fall behind the catalog the first time a tool is added.

Array<object>

object

key

required

string

description

required

string

prefix

First characters of the token. The token itself is shown once, at issue.

string | null

issued_at

string | null format: date-time

last_used_at

string | null format: date-time

expires_at

string | null format: date-time

endpoint

required

Public MCP address; empty when the gateway is not published.

string

clients

required

Clients connected over OAuth. Empty means nobody connected, or all were removed.

Array<object>

object

required

string format: uuid

name

required

string

connected_at

required

string format: date-time

last_used_at

string | null format: date-time

tools

required

Array<object>

object

name

required

string

group

required

Subject area the tool belongs to; the panel groups by it.

string

mode

required

Whether the tool reads or changes things.

string

Allowed values: read write

allowed

required

The token’s scopes cover this tool.

boolean

available

required

The plan permits this tool. False cannot be fixed by a checkbox.

boolean

token

Plaintext token. Present only in the response that issued it.

string

Example

{
  "tools": [
    {
      "mode": "read"
    }
  ]
}

400

Request failed validation (code=validation_failed), with per-field errors.

application/problem+json

RFC 9457 problem document with a stable machine code.

object

type

required

string format: uri

title

required

string

<= 256 characters

status

required

integer

>= 100 <= 599

code

required

Stable machine-readable error code (03 §2.4).

string

Allowed values: unauthorized forbidden csrf_rejected not_found conflict idempotency_conflict validation_failed rate_limited payload_too_large unsupported_agent_version temporarily_unavailable offline_queue_full online_queue_full plan_required server_limit_reached feature_not_entitled account_in_grace account_frozen payment_pending payment_expired payment_amount_mismatch change_already_pending change_already_applied change_effective reserve_not_covered direction_changed

detail

string

<= 2048 characters

instance

string

<= 512 characters

request_id

UUID (v7 for new entities; v4 accepted during migration).

string format: uuid

errors

Array<object>

<= 100 items

object

path

required

JSON Pointer to the offending field.

string

<= 512 characters

code

required

string

<= 64 characters

Example

{
  "type": "https://ermeon.com/problems/validation",
  "code": "unauthorized"
}

401

Missing/invalid credentials (code=unauthorized).

application/problem+json

RFC 9457 problem document with a stable machine code.

object

type

required

string format: uri

title

required

string

<= 256 characters

status

required

integer

>= 100 <= 599

code

required

Stable machine-readable error code (03 §2.4).

string

detail

string

<= 2048 characters

instance

string

<= 512 characters

request_id

UUID (v7 for new entities; v4 accepted during migration).

string format: uuid

errors

Array<object>

<= 100 items

object

path

required

JSON Pointer to the offending field.

string

<= 512 characters

code

required

string

<= 64 characters

Example

{
  "type": "https://ermeon.com/problems/validation",
  "code": "unauthorized"
}

403

Authenticated but not permitted. code=forbidden — role/scope mismatch; code=feature_not_entitled — the plan does not include the capability; code=account_frozen — the account is frozen and this operation is declared x-ermeon-frozen: deny. The three are deliberately distinct: only the last one is fixed by a top-up (13 §5.6).

application/problem+json

RFC 9457 problem document with a stable machine code.

object

type

required

string format: uri

title

required

string

<= 256 characters

status

required

integer

>= 100 <= 599

code

required

Stable machine-readable error code (03 §2.4).

string

detail

string

<= 2048 characters

instance

string

<= 512 characters

request_id

UUID (v7 for new entities; v4 accepted during migration).

string format: uuid

errors

Array<object>

<= 100 items

object

path

required

JSON Pointer to the offending field.

string

<= 512 characters

code

required

string

<= 64 characters

Example

{
  "type": "https://ermeon.com/problems/validation",
  "code": "unauthorized"
}

503

A dependency the endpoint needs is not configured or is temporarily unavailable (code=unavailable). The rest of the API keeps working — an absent external integration must not take the service down.

application/problem+json

RFC 9457 problem document with a stable machine code.

object

type

required

string format: uri

title

required

string

<= 256 characters

status

required

integer

>= 100 <= 599

code

required

Stable machine-readable error code (03 §2.4).

string

detail

string

<= 2048 characters

instance

string

<= 512 characters

request_id

UUID (v7 for new entities; v4 accepted during migration).

string format: uuid

errors

Array<object>

<= 100 items

object

path

required

JSON Pointer to the offending field.

string

<= 512 characters

code

required

string

<= 64 characters

Example

{
  "type": "https://ermeon.com/problems/validation",
  "code": "unauthorized"
}

Turn access on or off, or change which tools are allowed

Authorizations

Request Bodyrequired

Examplegenerated

Responses

200

Example

400

Example

401

Example

403

Example

503

Example

Request Body^required

Example^generated